3

I want to protect my computer from fake USB keyboards like the USB rubber ducky .

But I don't know if it will lock the screen before USB Rubber Ducky starts working. I don't want to buy a rubber ducky to check this.

How can I further test the keyboard detector, if I don't have access to the USB Rubber Ducky myself?

  • You could disable your USB ports altogether. – Tom K. Nov 20 '17 at 14:56
  • 5
    @Tom, turning off the computer is another solution. It's quite obvious that he wants to use legitimate USB keyboards. – SPRBRN Nov 20 '17 at 14:59
2

If your policies do not permit users to bring in their own peripherals, you may want to consider using Product ID & Vendor ID whitelisting software. Remember, that this will cause the system to effectively disable ANY non whitelisted device, including those that may be built in, like webcams and smartcard readers.

Otherwise, consider creating a GPO that requires password input for all UAC prompts, as that will effectively limit any keyboard emulator to nonprivileged access, and will not prevent assistive devices (like some OTP keys used by blind users, that emulate a keyboard and type the token code.)

This is one of the harder vectors to defend against, because the computer typically trusts that the input given by the user is based on the users intentions.

  • Another option is to block all USB keywords if there is already one present. – Anders Feb 20 '18 at 18:29
1

If Penteract's software performed the required action when a keyboard USB was plugged in, it is a fair assumption that it would block a rubber ducky as well (they are both HIDS).

The more traditional defense against a rubber ducky includes limiting access to powershell, the cmd prompt, and the run command as these are the most common ways a rubber ducky executes malicious code.

  • But will it be fast enough to lock before the rubber ducky starts working? – 123 Nov 20 '17 at 16:56
0

This may not be a great alternative but if you have a spare device android device that meet Kali nethunters requirements you could root and install that.

This will let you perform HID keyboard and BadUSB attacks. Again might not be ideal as it requires rooting a device - but it should also be a consideration if you are trying to mitigate these sorts of attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.